Skip to main content
Every Public API request requires a workspace API key. Generate or copy the key from Settings → Public API in the PostlyBee dashboard.

Bearer header

Send the key in the Authorization request header using the Bearer scheme:

Unauthorized requests

Missing, malformed, or unknown tokens return 401 Unauthorized.
The API does not accept a raw key such as Authorization: YOUR_API_KEY. The Bearer prefix is required.

Keep keys safe

  • Store keys in environment variables or a managed secret store.
  • Call PostlyBee from trusted server-side code, not a public browser bundle.
  • Never put keys in URLs, analytics events, screenshots, or support messages.
  • Rotate a key immediately if it is exposed.
REST API keys and OAuth-issued MCP access tokens both use the Bearer header, but they are different credentials and should not be interchanged.
Last modified on August 26, 2026